#pragma once

enum class ItemType : short
{
	None,
	ProcessCreate,
	ProcessExit,
	ThreadCreate,
	ThreadExit,
	ImageLoad,
	RegistrySetValue
};

class ItemHeader
{
public:
	ItemType      m_Type;
	USHORT        m_Size;
	LARGE_INTEGER m_Time;
};

class ProcessExitInfo : public ItemHeader
{
public:
	ULONG m_ProcessId;
};

class ProcessCreateInfo : public ItemHeader
{
public:
	ULONG  m_ProcessId;
	ULONG  m_ParentProcessId;
	USHORT m_CommandLineLength;
	USHORT m_CommandLineOffset;
};

class ThreadCreateExitInfo : public ItemHeader
{
public:
	ULONG m_ThreadId;
	ULONG m_ProcessId;
};

CONST ULONG MaxImageFile = 300;

class ImageLoadInfo : public ItemHeader
{
public:
	ULONG     m_ProcessId;
	PVOID     m_LoadAddress;
	ULONGLONG m_ImageSize;
	WCHAR     m_ImageFileName[MaxImageFile + 1];
};

class RegistrySetValueInfo : public ItemHeader
{
public:
	ULONG m_ProcessId;
	ULONG m_ThreadId;
	WCHAR m_KeyName[256];
	WCHAR m_ValueName[64];
	ULONG m_DataType;
	UCHAR m_Data[128];
	ULONG m_DataSize;
};